Computer networks form the information backbone of most businesses today, carrying extensive amounts of data including application data, stored data, e-mail, multimedia, and applications themselves Access to those networks is essential for the operation of most businesses, since communications regarding products and services and transactions in which those products and services are sold are frequently conducted over the network. Modern computer networks in a corporation are accessed not only by employees, but also by customers, partners, and in many cases by the general public.
Because these networks are almost always connected to the Internet, they are subject to attack by hackers or other individuals seeking to illicitly gain access to confidential information. Hackers or other individuals may attempt to gain access to sensitive data, or they may attempt to alter or corrupt part of the network in an effort to either steal valuable information or harm the corporation. Some of the techniques a hacker may use include, but are not limited to, password sniffing, buffer overflows, port scans, denial-of-service attacks, Trojans, or viruses.
One technique currently used to protect corporate networks is the use of different types of protection devices and software applications that operate at different levels or layers within the network. The different layers of the network are frequently modeled according to the International Organization for Standardization (ISO) model for computer networking, called the Open Systems Interconnect (OSI) Reference Model, and the Institute of Electrical and Electronic Engineers (IEEE) 802 model. The ISO OSI and IEEE 802 models define a modular approach to networking, with each layer responsible for some discrete aspect of the networking process. By placing separate security systems at multiple levels or layers within the network it is possible to provide more than one level of protection, although having separate security systems can be expensive and inefficient.
The OSI model describes the flow of data in a network, from the flow of information over the actual physical connections up to the layer containing the user's applications. Each layer is able to communicate with the layers above it and below it, but it conceptually communicates with the corresponding layer on another system. Layers are segregated in that one layer does not need to have knowledge of another layer, but simply deals with the transport of information within that layer according to the functionality of that layer. The TCP/IP model differs somewhat from the OSI model, but it follows the same general layered design concept.
FIG. 1 illustrates an exemplary flow of communications between a sending process 110 and a receiving process 120. Communications between the processes (devices) are performed at various different layers. As illustrated, the layers of communication include an application layer 130, a presentation layer 140, a session layer 150, a transport layer 160, a network layer 170, a data link layer 180 and a physical layer 190. An overview of the layers, from the highest layer on down, is as follows:
The application layer (e.g., layer 7) 130 is the level at which applications access network services. It represents the interface for programs such as e-mail, viewing of web pages, access to databases, and other types of services typically provided by networked computers.
The presentation layer (e.g., layer 6) 140 translates data from the application layer into an intermediary format. It can compress data as necessary for transport, or provide data encryption when required.
The session layer (e.g., layer 5) 150 establishes dialog between two computers in a session, allows two applications on different computers to establish, use, and end the session, and regulates which side transmits, when and for how long.
The transport layer (e.g., layer 4) 160 handles error recognition and recovery, and it can repackage long messages when necessary into small packets for transmission. At the receiving end, the transport layer rebuilds packets into the original message, and also sends receipt acknowledgments.
The network layer (e.g., layer 3) 170 addresses messages and translates logical addresses and names into physical addresses such as IP addresses. The network layer also controls switching and routing and manages traffic so as to avoid problems with congestion of data packets.
The data link layer (e.g. layer 2) 180 packages raw bits from a physical layer into frames. These frames represent logical, structured packets for data. The data link layer ensures that data is effectively transferred from computer-to-computer without errors. The data link layer awaits acknowledgement of the receipt of a frame from the receiving computer, and in some circumstances it will retransmit a frame if necessary.
The physical layer (e.g. layer 1) 190 is responsible for the transmission of the individual bits over a particular physical medium (e.g., twisted wire pair cable, wireless connection, fiber optic cable), and it regulates the transmission of that stream of bits over the physical medium. This layer encompasses the connection of the computer to the network interface, and the format for the transmission of the signals over that particular physical medium.
Although various types of equipment and software exist to protect a network by analyzing data at a particular layer, these units do not act in conjunction with one another. This results in inefficiencies in operation, as well as in installation and setup. Each piece of equipment or software must be set up and programmed independently. Traffic flows through each of the protection systems are not coordinated, resulting in inefficiencies in processing and an inability to effectively manage high volumes of traffic.
Programming of equipment can be particularly tedious, since each piece must be programmed according to the particulars of that manufacturer and with respect to the functionality of that layer. Network administrators must be knowledgeable of a vast array of systems and techniques, and constantly monitor multiple systems, if they are to ensure protection of network resources. As well-publicized breaches of network security have made clear, this is a nearly impossible task with current tools.
Furthermore, many systems, including some firewalls and server operating systems, provide broad access to resources by default, and require explicit configuration to protect resources. Insertion of many current systems into a network can actually reduce network security until they are properly configured. Networks, and the businesses that are dependent upon them, are left vulnerable.
For the foregoing reasons, there is a need for a method for defining security policies at a high level and having the ability to automatically generate machine compatible rules for multiple layers in the network.